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DETAILED ACTION 



1. 



This office action is in response to the amendment filed 05/15/07. 



2. 



Claims 1-3 and 9-16 were amended. 



3. 



Claims 1-16 are pending in this office action. 



Response to Amendment 



4. The examiner withdraws the rejection of claims 3, 11, 12, 15 and 16 under 35. 
U.S.C. 112, second paragraph, based on applicant's amendment. 

5. Applicant's arguments filed 05/15/07 have been fully considered but they are not 
persuasive. See Response to Arguments. Note that while the same art is cited in this 
office action, the grounds of rejection for some claims have changed based on 
applicant's amendment. 



6. Claims 12 and 16 are objected to as being dependent upon a rejected base 
claim, but would be allowable if rewritten in independent form including all of the 
limitations of the base claim and any intervening claims. 

7. The following is a statement of reasons for the indication of allowable subject 
matter: The following subject matter is not found in the prior art nor is it obvious in view 
of the prior art: 

"a web based programming language method including a run-as-task descriptor 
operable for determining a current task name value associated with a request to 
access an application; 



Allowable Subject Matter 



s 
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wherein said run-as-task descriptor values include: 

caller, operable for specifying a current task name as 'run with caller's task 

name; 

own, operable for specifying a current task name as 'run with an 
application name of an application containing a current component'; and 

specified, operable for specifying an explicit task name to run as a current 
task name." (as from claim 12 and 16) 



Claim Objections 

8. Claim 2 is objected to because of the following informalities: Claim 2 includes 
the language "selects at one of said plurality of policies". This language is 
grammatically unclear. Appropriate correction is required. 



Claim Rejections - 35 USC § 102 

9. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

10. Claims 1, 9 and 13 are rejected under 35 U.S.C. 102(e) as being anticipated by 
U.S. Patent Application Publication 2004/0059946 by Price (Price). 
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1 1 . With respect to Claim 1 , Price teaches a system for providing context-based 
dynamic policy assignment in a distributed processing environment, comprising: 

a first resource management host in communication with a client system via a 
distributed network architecture (Pages 1-2 [0018]-[0019] server system connect to 
client through network); 

at least one application executable by said first resource management host 
(Page 19 [0019] - hosted architecture with applications executed by server); 

a dynamic policy assignment system executing on said first resource 
management host (Page 2 [0020] and Page 3 [0027]-[0028]: servlet and associated 
components provide policy assignment) 

a plurality of policies stored on said first resource management host (Page 2 
[0021] and Page 3 [0027]-[0028]: security data source stores policy information such as 
group memberships and security flags), wherein at least one of the plurality of task 
names associated with said client system (Page 3 [0028] set of flags are specific to a 
user object instantiated in response to a client-side session request), and a plurality of 
task names associated with a request to access an application are mapped to the 
plurality of policies (Page 3 [0028] and [0033] -set of business rules are associated with 
application, the business rules are mapped to sets of security flags); and 

an application profile associated with said client system, said application profile 
received by said first resource management host in response to a request by said client 
system to receive application hosting services, said application hosting services 
including executing said at least one application on behalf of said client system (Page 2 
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[0019], [0022]-[0023] request includes application profile including profile ID and task 
name); 

wherein said dynamic policy assignment system performs: 
receiving said request at said first resource management host (Page 2 [0022]- 
[0023]); 

based upon a profile ID and task name associated with said application profile, 
selecting at least one of said plurality of policies for an application instance related to 
said request (Page 2 [0025]-[0028]: security policies are selected arid established 
based on the context of the application and user information associated with the client 
request); 

associating said at least one of said plurality of policies to said application 
instance (Page 2 [0025]-[0029]: security policies are selected and established based on 
the context of the application and user information associated with the client request); 
and 

executing said application on behalf of said client system (Page 3 [0028] and 
Page 4 [0036]-[0037] and [0040]: execution of the requested application occurs based 
on the policies associated with it) 

changing dynamically at least one of said plurality of policies for an application 
instanced based on a task name change (Page 2 [0025] and Page 3 [0028]- policy is 
based on context of application and business rule, if the business rule changes, the 
policy changes as well). 
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12. With respect to claims 9 and 13, Price teaches a method (and corresponding 
storage medium) for providing context-based dynamic policy assignment in a distributed 
processing environment, comprising: 

receiving a request at a first host system to execute a first application on behalf 
of a client system, said request including an application profile (Page 2 [0019], [0022]- 
[0023] request includes application profile including profile ID and task name); 

based upon a profile ID and one or more task names associated with said 
application profile (Page 2 [0019], [0022]-[0023] request includes application profile 
including profile ID and business rules), selecting at least one policy for an application 
instance related to said request (Page 2 [0025]-[0028]: security policies are selected 
and established based on the context of the application and user information associated 
with the client request) and mapping said one ore more task names to a plurality of 
policies (Page 3 [0028] and [0033] -set of business rules are associated with 
application, the business rules are mapped to sets of security flags), wherein at least 
one of the plurality of policies is associated with said client system (Page 3 [0028] set of 
flags are specific to a user object instantiated in response to a client-side session 
request); 

associating said at least one policy to said application instance (Page 2 [0025]- 
[0029]: security policies are selected and established based on the context of the 
application and user information associated with the client request); 
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executing said first application on behalf of said client system (Page 3 [0028] and 
Page 4 [0036]-[0037] and [0040]: execution of the requested application occurs based 
on the policies associated with it); and 

changing dynamically said at least one policy associated with said application 
instance based upon a task name change (Page 2 [0025] and Page 3 [0028]- policy is 
based on context of application and business rule, if the business rule changes, the 
policy changes as well). 

Claim Rejections - 35 USC § 103 

1 3. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

14. Claims 2-8, 10, 11, 14 and 15 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Price in view of U.S. Patent 7,076,562 by Singhal et al. (Singhal). 

1 5. With respect to Claim 2, Price further teaches said dynamic policy assignment 
system selects one of the plurality of policies of a given application based on the task 
name associated with the application (Page 2 [0025] and Page 3 [0028] and [0033]). 

Price does not explicitly disclose further comprising a second resource 
management host in communication with said client system and said first resource 
management host via said distributed network architecture, said second resource 
management host receiving said request forwarded by said first resource management 
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host; wherein said request includes a request to execute a second application different 
from said at least one application, said second application stored on said second 
resource management host. 

Singhal teaches a system with application level enforcement of policies based on 
user requests and an associated context (Col. 3 lines 58-67 and Col. 4 lines 47-54 and 
Col. 7 lines 56-67). The system includes a first resource management host, which can 
forward a users request to a second resource management host, allowing the second 
host to execute an application stored on the second host (Col. 5 lines 1-14 and Col. 6 
lines 58-67). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the system disclosed by Price and modify it as indicated by 
Singhal such that it further comprises a second resource management host in 
communication with said client system and said first resource management host via 
said distributed network architecture, said second resource management host receiving 
said request forwarded by said first resource management host; wherein said request 
includes a request to execute a second application different from said at least one 
application, said second application stored on said second resource management host 
and wherein said dynamic policy assignment system selects at one of said plurality of 
policies of second application based on a task name associated with said second 
application. One would be motivated to have this, as it is desirable to implement 
policies associated with applications including those on other host systems (In Singhal: 
Col. 2 lines 61-66). 
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16. With respect to claim 3, Price further teaches wherein said first resource 
management host and said second resource management host are operating in a web 
based programming environment and provide web based programming services to said 
client system via said dynamic policy assignment system (In Price: Page 2 [0020] - java 
operational environment for providing services). 

17. With respect to claim 4, Price further teaches wherein said policies include at 
least one of: security; transaction; persistence; and performance (In Price: Page 2 
[0021] and Page 3 [0027]). 

18. With respect to claim 5, Price further teaches wherein said plurality of policies 
includes an access intent policy (In Price: Page 2 [0021] and Page 3 [0027]). 

19. With respect to claim 6, Price further teaches wherein said application profile 
includes a profile ID operable for identifying said client system and distinguishing said 
client system from other client systems (In Price: Page 2-3 [0025]-[0026]: user 
identification such as userid). 

20. With respect to claim 7, Price further teaches wherein said application profile 
includes a task name operable for identifying an application requested by said client 
system (In Price: Page 2 [0025]-[0026]: application name with business rule). 

21 . With respect to claim 8, Price further teaches wherein said task name is a default 
value reflecting a name of said application requested by said client (In Price: Page 2 
[0025]-[0026]: application name with business rule). 

22. With respect to claims 10 and 14, Price further teaches said dynamic policy 
assignment system selects one of the plurality of policies of a given application based 
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on the task name associated with the application (Page 2 [0025] and Page 3 [0028] and 
[0033]). 

Price does not explicitly disclose forwarding said request to a second host 
system along with said application profile wherein said request contains a request to 
access a second application stored on said second host system. 

Singhal teaches a system with application level enforcement of policies based on 
user requests and an associated context (Col. 3 lines 58-67 and Col. 4 lines 47-54 and 
Col. 7 lines 56-67). The system includes a first resource management host, which can 
forward a users request to a second resource management host, allowing the second 
host to execute an application stored on the second host (Col. 5 lines 1-14 and Col. 6 
lines 58-67). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the method (and corresponding storage medium) disclosed 
by Price and modify it as indicated by Singhal such that it further comprises forwarding 
said request to a second host system along with said application profile wherein said 
request contains a request to access a second application stored on said second host 
system and wherein said dynamic policy assignment system selects at least one policy 
with said second application instance based on a task name associated with said 
second application. One would be motivated to have this as it is desirable to implement 
policies associated with applications including those on other host systems (In Singhal: 
Col. 2 lines 61-66). 
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23. With respect to claim 1 1 , Price further teaches wherein said first host system and 
said second host system are operating in a web based programming language 
environment and provide web based programming language services to said client 
system via said dynamic policy assignment system (In Price: Page 2 [0020] - java 
operational environment for providing services). 

24. With respect to claim 15, Price further teaches wherein said first host system and 
said second host system are operating in a web based programming language 
environment and provide web based programming language services to said client 
system via said dynamic policy assignment system (In Price: Page 2 [0020] - java 
operational environment for providing services). 



Response to Arguments 

25. Applicant's arguments filed 05/15/07 have been fully considered but they are not 
persuasive. 

26. Applicant argues on page 9 of the remarks - "Price fails to disclose or suggest a 
plurality of policies stored on said first resource management host, wherein at least one 
of the plurality of policies is associated with said client system, and a plurality of task 
names associated with a request to access an application are mapped to the plurality of 
policies, as recited in claim 1." 

a. Examiner's response - Price teaches a plurality of polices in the form of 
sets of flags (Page 3, [0028]). The set of flags are specific to a user object 
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instantiated in response to a client-side session request (i.e. - associated with 
said client system). Further more, the determination of what set of flags to apply 
depends on the specific request to access an application (Page 3 [0028]). The 
request corresponds to a particular context of a service, application and business 
rule (Page 2 [0025]). The examiner interprets the business rules to correspond 
to the plurality of task names based on the disclosure on page 3, [0033]. 
Particularly, a set of business rules is associated with an application. As such, a 
particular request with a context for a given service and application will have a 
plurality of task names associated with it (business rules). Each context of the 
given service, application and one of the plurality of business rules will have 
mapped to it a set of security flags (a policy). As such, the teachings of Price are 
within the scope of the claim language. 

Conclusion 

27. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

28. U.S. Patent 6,466,984 by Naveh et al. - Discloses the mapping of policies to 
traffic flows generated by an application instance. 
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29. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL See MPEP 
§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to David Lazaro whose telephone number is 571-272- 
3986. The examiner can normally be reached on 8:30-5:00 M-F. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Saleh Najjar can be reached on 571-272-4006. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
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For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-91 99 (IN USA OR CANADA) or 571 -272-1 000. 





David Lazaro 
July 17, 2007 



